System and method for access to a password protected information handling system

BACKGROUND OF THE INVENTION

p-00021. Field of the Invention

p-0003The present invention relates in general to the field of information handling system password protection, and more particularly to a system and method for access to a password protected information handling system.

p-00042. Description of the Related Art

p-0005As the value and use of information continues to increase, individuals and businesses seek additional ways to process and store information. One option available to users is information handling systems. An information handling system generally processes, compiles, stores, and/or communicates information or data for business, personal, or other purposes thereby allowing users to take advantage of the value of the information. Because technology and information handling needs and requirements vary between different users or applications, information handling systems may also vary regarding what information is handled, how the information is handled, how much information is processed, stored, or communicated, and how quickly and efficiently the information may be processed, stored, or communicated. The variations in information handling systems allow for information handling systems to be general or configured for a specific user or specific use such as financial transaction processing, airline reservations, enterprise data storage, or global communications. In addition, information handling systems may include a variety of hardware and software components that may be configured to process, store, and communicate information and may include one or more computer systems, data storage systems, and networking systems.

p-0006One concern with the use of information handling systems is the security of information stored or processed by an information handling system. Businesses often have confidential and sensitive information, such as customer lists and identities, that are stored on information handling systems which, if compromised, could lead to business difficulties or customer complaints. Individuals typically maintain private and financial information, such as medical and financial records, that are stored on information handling systems which, if compromised, could lead to embarrassment of or theft from the individual. In order to secure information, businesses and individuals typically invest in a variety of security applications that prevent access by unauthorized users, such as network password protection and firewalls. A cat-and-mouse game is often played between information technology administrators seeking to protect information and hackers seeking to illicitly acquire information. Often, security measures taken to secure information impact legitimate users with delays or inconveniences in using the information. For instance, users are typically required to have a password to access a network. If a user forgets the password or compromises the password, a network administrator generally must get involved to allow the user access to the network, such as by retrieving or changing the password.

p-0007One security risk that presents a particular danger to information is the physical theft of an information handling system. Desktop systems are generally kept in a physically secure area that makes theft difficult, however, laptop or portable systems are often exposed in non-secure areas that make them vulnerable to theft. For instance, businesses often supply portable systems to employees who travel frequently. These portable systems are often configured to connect with the business' network through the Internet or through a cradle located in the employee's office. Thus, physical theft of a portable system can expose the entire business' network to attack by exposing security information that allows remote access to the network. Individuals also often use portable systems to store private information that is subject to disklosure if the system is stolen. In order to counter the risk of physical theft, portable systems are generally protected by one or more passwords. For instance, hard disk drives have both a user password and a master password to access information. The user selects the user password for daily use while the master password allows access if the user loses or forgets the user password. Similarly, the BIOS often has user and administrator password protection to limit access to the information handling system to an authorized user or administrator. In the event that a user forgets a password, information technology administrators need access to the administrator password of the BIOS and the master password of the hard disk drive to access the system. However, if the master password of the hard disk drive is changed from its manufacture setting, the manufacturer of the information handling system cannot aid in the retrieval of the lost password. The ATA specification defines only two passwords for a hard disk drive. Because the irretrievable loss of a hard disk drive password is the equivalent from the user's perspective of a hard disk drive failure and often leads to service calls or system returns that increase a manufacturer's cost, information handling system manufactures typically enable one password for the user and retain the other password as a failsafe to use in response to a loss of a user password.

SUMMARY OF THE INVENTION

p-0008Therefore a need has arisen for a system and method which manages password access to an information handling system in the event a user password is unavailable.

p-0009In accordance with the present invention, a system and method are provided which substantially reduce the disadvantages and problems associated with previous methods and systems for password protection of and access to an information handling system. User passwords associated with one or more physical components of an information handling system are stored in a predetermined physical component under the protection of an admin password so that input of the admin password allows access to the stored passwords from the predetermined physical component.

p-0010More specifically, a security module associated with the BIOS and hard disk drive of an information handling system coordinates the storage of a hard disk drive password on the BIOS with access restricted by an admin password. A user accesses the hard disk drive by inputting the hard disk drive password to the hard disk drive or by inputting the admin password to the BIOS. The security module determines whether to send the hard disk drive password from BIOS to unlock the hard disk drive based on the entry of the admin password to the BIOS. A separate BIOS password restricts access to the BIOS without releasing the hard disk drive password. In addition, a master password remains available on the hard disk drive, such as for use by the manufacturer as a failsafe in the event of loss of the user password. Thus, information technology administrators have a single admin password to access both the BIOS and the hard disk drive, the manufacturer remains able to unlock the hard disk drive, and the user may have distinct passwords to protect the BIOS and the hard disk drive. The integrity of the passwords is maintained by storing the hard disk drive password on the BIOS only if an admin password exists at creation of the hard disk drive password, by passing the hard disk drive password from the BIOS only in response to the input of the admin password, and by deleting the hard disk drive from the BIOS if the admin password is removed.

p-0011The present invention provides a number of important technical advantages. One example of an important technical advantage is that an information technology administrator retains centralized access to plural physical processing components by entry of a single admin password, which releases the passwords of the other physical processing components. The manufacturer of the information handling system retains the ability to unlock desired components, such as the hard disk drive, with a master password so that the loss of a user password will not result in a failure of an information handling system. Entry of the admin password automatically sends the user passwords to the components so that information technology administrators have a seamless and simple system and method for managing password protected information handling systems.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention may be better understood, and its numerous objects, features and advantages made apparent to those skilled in the art by referencing the accompanying drawings. The use of the same reference number throughout the several figures designates a like or similar element.

<figref idrefs="DRAWINGS">FIG. 1</figref> depicts a block diagram of an information handling system having access protected by BIOS and hard disk drive passwords;

<figref idrefs="DRAWINGS">FIG. 2</figref> depicts a flow diagram of a process for storing a hard disk drive password on a BIOS; and

<figref idrefs="DRAWINGS">FIG. 3</figref> depicts a flow diagram of a process for retrieving a hard disk drive password from a BIOS in response to an administrative password.

DETAILED DESCRIPTION

p-0016Access to password-protected components of an information handling system is aided by the secured storage of component passwords accessible by an administrative password. For purposes of this disklosure, an information handling system may include any instrumentality or aggregate of instrumentalities operable to compute, classify, process, transmit, receive, retrieve, originate, switch, store, display, manifest, detect, record, reproduce, handle, or utilize any form of information, intelligence, or data for business, scientific, control, or other purposes. For example, an information handling system may be a personal computer, a network storage device, or any other suitable device and may vary in size, shape, performance, functionality, and price. The information handling system may include random access memory (RAM), one or more processing resources such as a central processing unit (CPU) or hardware or software control logic, ROM, and/or other types of nonvolatile memory. Additional components of the information handling system may include one or more disk drives, one or more network ports for communicating with external devices as well as various input and output (I/O) devices, such as a keyboard, a mouse, and a video display. The information handling system may also include one or more buses operable to transmit communications between the various hardware components.

p-0017Referring now to <figref idrefs="DRAWINGS">FIG. 1</figref>, a block diagram depicts an information handling system <b>10</b> having access protected by BIOS and hard disk drive passwords. Information handling system <b>10</b> includes a number of physical processing components for processing information, such as a CPU <b>12</b> that performs instructions, RAM <b>14</b> that stores information, a chipset <b>16</b> that supports peripherals like a display <b>18</b> and keyboard <b>20</b>, a hard disk drive <b>22</b> that permanently stores information and a BIOS <b>24</b> that coordinates the operation of the physical processing components. Software components, such as an operating system and associated drivers, support interactions between physical components and applications. The various processing components are integrated into a common housing, although portable systems typically allow removal of some components, such as hard disk drive <b>22</b>.

p-0018In order to manage password security of information handling system <b>10</b>, a hard disk drive security module <b>26</b> operates in firmware of hard disk drive <b>22</b> and an administrator security module <b>28</b> operates in firmware of BIOS <b>24</b>. BIOS <b>24</b> allows a user to select a user password <b>30</b> to be stored in security module <b>26</b> that a user must input to access hard disk drive <b>22</b>. When user password <b>30</b> is initially selected, BIOS <b>24</b> also creates a master password <b>32</b> which is saved in security module <b>26</b>. User access to information on hard disk drive <b>22</b> is restricted absent the entry of user password <b>30</b>, effectively preventing use of the system in the event that a user does not know the password. If user password <b>30</b> is lost or forgotten, the manufacturer of information handling system <b>10</b> recreates master password <b>32</b> to give to an authorized user and allow access to hard disk drive <b>22</b> by overriding user password <b>30</b>, thus avoiding system failure. BIOS administrator security module <b>28</b> allows a user to set a BIOS password <b>34</b> and a system administrator to set an admin password <b>36</b>. When BIOS password <b>34</b> is selected, BIOS administrator security module <b>28</b> restricts access to BIOS <b>24</b> unless the BIOS password is entered, thus securing information handling system <b>10</b> from an unauthorized boot. Admin password <b>36</b> overrides the restriction to BIOS use absent the BIOS password so that an administrator can always access BIOS <b>24</b> and boot information handling system <b>10</b>, even if the user forgets or loses BIOS password <b>34</b>.

p-0019Although an information technology administrator can secure access to BIOS <b>24</b> with admin password <b>36</b>, information handling system <b>10</b> remains generally inaccessible unless the administrator also knows user password <b>30</b> or master password <b>32</b>. To ensure administrator access to hard disk drive <b>22</b> without retrieving the master password from the manufacturer, hard disk drive security module <b>26</b> and BIOS administrator security module <b>28</b> cooperate to store user password <b>30</b> in a secure area of BIOS <b>24</b>, such as with administrative password <b>36</b> and BIOS password <b>34</b>. Upon input of admin password <b>36</b>, administrative security module <b>28</b> automatically provides user password <b>30</b> to hard disk drive security module <b>26</b> to allow access to hard disk drive <b>22</b>. Hard disk drive <b>22</b> remains inaccessible if BIOS password <b>34</b> is entered unless either user password <b>30</b> or master password <b>32</b> is entered, however, hard disk drive <b>22</b> is accessible at any time by entry of admin password <b>36</b>. To ensure the integrity of the passwords, security modules <b>26</b> and <b>28</b> restrict the communication of user password <b>30</b> between hard disk drive <b>22</b> and BIOS <b>24</b>. For instance, user password <b>30</b> is only stored on BIOS <b>24</b> if admin password <b>36</b> exists when user password <b>30</b> is created. User password <b>30</b> is only communicated from BIOS <b>24</b> to hard disk drive <b>22</b> if admin password <b>36</b> is entered. If admin password <b>36</b> is removed from BIOS <b>24</b>, user password <b>30</b> is also deleted from BIOS <b>24</b> but remains on hard disk drive <b>22</b>. Admin password <b>36</b> will only unlock a hard disk drive in a system on which the hard disk drive password is created, but master password <b>32</b> remains available from the manufacturer if needed.

p-0020Referring now to <figref idrefs="DRAWINGS">FIG. 2</figref>, a flow diagram depicts a process for storing a hard disk drive password on a BIOS. The process begins at step <b>38</b> upon a user request through the BIOS to create the hard disk drive password and, at step <b>40</b>, the password is sent to the hard disk drive as a new user password. At step <b>42</b>, a determination is made of whether the hard disk drive accepts the password and, if not, at step <b>44</b> the user is notified of the failure. If the hard disk drive accepts the password at step <b>42</b>, the process continues to step <b>46</b> at which the hard disk drive password is sent to the BIOS microcontroller for storage. At step <b>48</b>, a determination is made of whether the user is in system setup and at step <b>50</b> a determination is made of whether an administrative password is already installed in the BIOS. If the determinations at steps <b>48</b> and <b>50</b> are no, the process ends without the storage of the hard disk drive password on the BIOS. If the determinations at both step <b>48</b> and step <b>50</b> are yes, the process continues to step <b>52</b> to store the hard disk drive password in a secure location of the BIOS and ends at step <b>54</b>. The instructions for performing the storage of the hard disk drive password are distributed in BIOS and hard disk drive firmware or other secure portions of the information handling system.

p-0021Referring now to <figref idrefs="DRAWINGS">FIG. 3</figref>, a flow diagram depicts a process for retrieving a hard disk drive password from a BIOS in response to an administrative password. The process begins at step <b>56</b> with a prompt initiated by the BIOS for the hard disk drive password. At step <b>58</b>, a determination is made of whether an admin password is installed and, if not, the process continues to step <b>72</b> to send the password to the hard disk drive. If an admin password is installed, the process continues to step <b>60</b> to send the input password to the BIOS microcontroller for a determination at step <b>62</b> of whether the input password matches the admin password. If no match is found at step <b>62</b>, the process continues to step <b>72</b>, however if the input password matches the admin password, the process instead continues to step <b>64</b>. At step <b>64</b>, the hard disk drive password stored in the BIOS is provided to the information handling system for a length check at step <b>66</b> and then at step <b>68</b> provided to the hard disk drive as the hard disk drive password instead of the input password. At step <b>70</b> a determination is made of whether the hard disk drive is unlocked and, if so, at step <b>76</b> the process completes. If at step <b>70</b> the password from the BIOS does not unlock the hard disk drive, the process continues to step <b>72</b> to send the entered password to the hard disk drive. At step <b>74</b> a determination is made of whether the password unlocks the hard disk drive. If the hard disk drive is unlocked, the process completes at step <b>76</b> and, if not, the process completes at step <b>78</b> by notifying the user of the incorrect password.

p-0022Although the present invention has been described in detail, it should be understood that various changes, substitutions and alterations can be made hereto without departing from the spirit and scope of the invention as defined by the appended claims.